Student Result Management System CVE-2025-5599

This vulnerability presents HIGH real-world risk despite a moderately-scored CVSS of 7.3. Risk signals analysis: (1) CVSS Vector shows AV:N (network-accessible), AC:L (low attack complexity), PR:N (no privileges required), UI:N (no user interaction), and S:U/C:L/I:L/A:L (limited confidentiality, integrity, availability impact) — indicating easy exploitation with broad attack surface. (2) Public exploit disclosure significantly elevates real-world exploitation probability, moving this beyond theoretical risk. (3) The vulnerability affects a student information system, likely containing personally identifiable information (PII) such as student records, grades, and employment data. (4) Typical installations of such open-source management systems are often exposed to the internet with minimal security hardening. (5) SQL injection enables data exfiltration, authentication bypass, and potential remote code execution depending on database permissions. The CVSS score of 7.3 is justified and aligns with actual exploitability; this is NOT a false-positive high-CVSS case. Organizations running this software should prioritize patching immediately.

An attacker discovers a publicly accessible PHPGurukul Student Result Management System instance. They craft an HTTP request to /editmyexp.php with a malicious SQL injection payload in the emp1ctc parameter, such as: emp1ctc=1' UNION SELECT username, password, NULL FROM admin_users--. Since no authentication is required (PR:N) and the parameter is directly concatenated into an SQL query without sanitization, the database executes both the original query and the injected UNION statement. The attacker extracts admin credentials, logs in, and gains full access to student records, grades, and system configuration. Alternatively, a time-based blind SQL injection (e.g., emp1ctc=1' AND SLEEP(5)--) allows the attacker to exfiltrate data character-by-character. With public exploit code available, this attack requires minimal technical skill and can be automated, making large-scale targeting of education institutions feasible.